Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw

What it is

Drupal released fixes for five vulnerabilities, two of them critical remote code execution (RCE) flaws. CVE-2026-108099 is in the contributed Entity List module, which lets users build lists of entities without Views. CVE-2026-108097 is in the Field UI module in Drupal core. The other fixes are cross-site scripting (XSS) bugs, with CVE IDs and Gin theme versions that the catalog summary leaves out.

Preconditions / Affected

Neither RCE flaw is exploitable on its own. CVE-2026-108099 needs another contributed module to supply an exploit path. Drupal adds that custom code may also expose the vulnerable functionality, so a site with no known module combination could still be affected.

CVE-2026-108097 is not exploitable with core alone, but contributed modules provide serious exploit paths. For both flaws, at least one known path needs no authentication.

Earlier Drupal releases have reached end-of-life and get no security updates. Sites on those branches have no patch path short of upgrading.

What to do

• Update Entity List to 3.0.10.
• Update Drupal core to 11.4.10, 11.3.19 or 10.6.19.
• If Field UI is not needed, uninstall it. Drupal lists this as the mitigation for CVE-2026-108097.
• Update the Gin admin theme to 5.0.16 or 4.1.4 to fix its XSS bug.
• The core Link module XSS flaws (collectively CVE-2026-108515) and the Navigation module XSS flaw (CVE-2026-108514) are fixed by the same core updates. The page does not say this explicitly for each branch, so check the advisory.

Caveats

Drupal does not report exploitation in the wild for any of these. On 12 October 2026 it warned users to reserve time for core updates, saying "exploits might be developed within hours or days." The page does not name the contributed modules that form the exploit paths. It points to Drupal's security advisories page for details.